How to display data?

nicksrulz — Mon, 07 Aug 2023 19:02:13 GMT

Hi Experts,

Need help in displaying data , Currently i am able to display search data as

Status Date Date & Time REASON_CODE
FAILED 25/04/2023 25/04/2023 20:33 Z910
FAILED 25/04/2023 25/04/2023 20:11 Z910
FAILED 25/04/2023 25/04/2023 3:38 Z911
FAILED 25/04/2023 25/04/2023 3:37 Z911
FAILED 25/04/2023 25/04/2023 3:37 Z911
FAILED 25/04/2023 25/04/2023 3:36 Z911

using below query :
============================================
index=test sourcetype="*" STATUS_REASON_CODE IN (U220, U902, U904, U905, Z704, Z900, Z902, Z903, Z904, Z910, Z911, Z912, Z913, Z914, Z920, Z922, Z923, Z924) STATE = FAILED | fields STATE _time STATUS_REASON_CODE | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS Time | convert timeformat="%Y-%m-%d" ctime(_time) AS TimeDay | eval FailTime=case(field_name="Failure Time", _time) | eval ReasonCode=case(field_name="Reason Code", STATUS_REASON_CODE) | eval State=case(field_name="State", STATE) | eval minTime = (min(Time)) | rename STATUS_REASON_CODE as REASON_CODE | sort - Time | table STATE TimeDay minTime REASON_CODE
==================================================

Need help in displaying data as :

Status Date Start Time End Time REASON_CODE Count
FAILED 25/04/2023 25/04/2023 20:11 25/04/2023 20:33 Z910 2
FAILED 25/04/2023 25/04/2023 3:36 25/04/2023 3:38 Z911 4

Please help in modifying my query.

Re: Need help in displaying data

livehybrid — Fri, 04 Aug 2023 22:26:21 GMT

Instead of the | table command you might find something like this gives you what you need:

| stats count as ReasonCount, min(_time) as startTime, max(_time) AS endTime by REASON_CODE

topic How to display data? in Splunk Cloud Platform

How to display data?

Re: Need help in displaying data